JP6490879B2 - Information processing apparatus and information processing method - Google Patents

Description

  The present disclosure relates to an information processing apparatus and the like mounted on a vehicle.

  Patent Document 1 discloses a technique for detecting unauthorized data intrusion in an in-vehicle network or the like.

JP 2014-146868 A

  However, it may be difficult for the in-vehicle system of each vehicle to properly monitor the data in the in-vehicle system alone and maintain an appropriate monitoring level. On the other hand, when a system outside the vehicle monitors data in the in-vehicle system, a large amount of monitoring target data may be transmitted from the in-vehicle system to the external system. It is not easy to prepare resources for processing such a large amount of monitoring target data.

  Therefore, an object of the present disclosure is to provide an information processing apparatus capable of reducing the data amount of monitoring target data transmitted from an in-vehicle system while maintaining an appropriate monitoring level.

  An information processing apparatus according to an aspect of the present disclosure is an information processing apparatus mounted on a vehicle, and acquires an abnormality detection result indicating whether an abnormality is included in communication data in an in-vehicle network of the vehicle from an abnormality detector. And a sampling log in which the amount of data generated per unit time of the two types of logs of the communication data is smaller than that of the other log is provided outside the vehicle from a transmitter mounted on the vehicle. An output unit that outputs a sampling log transmission instruction to periodically transmit to the server device, and the output unit further includes the abnormality detection result indicating that the communication data includes an abnormality. If acquired, the transmitter transmits a full log, which is a log in which the amount of data generated per unit time is larger than the sampling log, from the two types of logs. Serial and outputs the full log transmission instruction for transmitting to the server device.

  Note that these comprehensive or specific aspects may be realized by a system, apparatus, method, integrated circuit, computer program, or non-transitory recording medium such as a computer-readable CD-ROM. The present invention may be realized by any combination of an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

  An information processing apparatus and the like according to an aspect of the present disclosure can reduce the data amount of monitoring target data transmitted from the in-vehicle system while maintaining an appropriate monitoring level.

FIG. 1 is a block diagram showing a configuration of a security system in the embodiment. FIG. 2 is a schematic diagram illustrating a sampling period in the embodiment. FIG. 3 is a comparison diagram of the sampling log and the full log in the embodiment. FIG. 4 is a data configuration diagram showing a log format in the embodiment. FIG. 5 is a graph showing the relationship between the sampling interval and the data amount. FIG. 6 is a comparison diagram showing the amount of data before and after compression. FIG. 7 is a block diagram showing a basic configuration of the security ECU in the embodiment. FIG. 8 is a block diagram illustrating a basic configuration of the server device according to the embodiment. FIG. 9 is a block diagram illustrating a configuration of a security system in a specific example. FIG. 10 is a block diagram showing a modified configuration of the security system in the specific example. FIG. 11 is a block diagram illustrating a configuration of a security ECU in a specific example. FIG. 12 is a block diagram illustrating a configuration of a security gateway device in a specific example. FIG. 13 is a block diagram illustrating a configuration of a server device in a specific example. FIG. 14 is a sequence diagram illustrating an operation related to transmission of a sampling log in a specific example. FIG. 15 is a sequence diagram illustrating an operation related to an abnormality detection process performed by the server device in the specific example. FIG. 16 is a sequence diagram showing operations related to the abnormality detection process performed by the security ECU in the specific example. FIG. 17 is a flowchart showing the operation of the security ECU in a specific example. FIG. 18 is a flowchart illustrating a first aspect of log recording processing performed by the security ECU in a specific example. FIG. 19 is a flowchart illustrating a second aspect of the log recording process performed by the security ECU in the specific example. FIG. 20 is a flowchart illustrating an abnormality detection process performed by the security ECU in a specific example. FIG. 21 is a flowchart illustrating a first aspect of log transmission processing performed by the security ECU in a specific example. FIG. 22 is a flowchart illustrating a second aspect of the log transmission process performed by the security ECU in the specific example. FIG. 23 is a flowchart illustrating a third aspect of the log transmission process performed by the security ECU in the specific example. FIG. 24 is a flowchart illustrating a first mode of operation of the server device in the specific example. FIG. 25 is a flowchart showing a second mode of operation of the server device in the specific example. FIG. 26 is a flowchart illustrating a first aspect of sampling interval update processing performed by the server device and the security ECU in a specific example. FIG. 27 is a flowchart illustrating a second aspect of the sampling interval update process performed by the server device and the security ECU in the specific example.

(Knowledge that became the basis of this disclosure)
In recent years, connected cars connected to external networks have been widely used. For example, the number of cars connected to the Internet may reach 250 million by 2020.

  On the other hand, the possibility that the vehicle is illegally controlled has begun to be pointed out. In particular, it has been pointed out that illegal data may invade CAN (Controller Area Network), which is widely spread as a communication standard for in-vehicle networks. And there is a possibility that the vehicle is illegally controlled by the illegal data. Therefore, a technique for protecting a vehicle from unauthorized data is being studied so that the vehicle is not illegally controlled by unauthorized data.

  For example, an in-vehicle system that is a system mounted on each vehicle may monitor data in the in-vehicle system in order to protect the vehicle from unauthorized data. However, since the in-vehicle system is mounted on the vehicle, it may not have sufficient processing capability. Therefore, it may be difficult for the in-vehicle system to properly monitor the data in the in-vehicle system alone and maintain an appropriate monitoring level.

  Further, for example, a system outside the vehicle may monitor data in the in-vehicle system. However, in this case, a large amount of monitoring target data may be transmitted from the in-vehicle system to an external system. It is not easy to prepare resources for processing such a large amount of monitoring target data.

  Therefore, an information processing apparatus according to an aspect of the present disclosure is an information processing apparatus mounted on a vehicle, and an abnormality detection result indicating whether an abnormality is included in communication data in an in-vehicle network of the vehicle. And a sampling log, which is a log in which the amount of data generated per unit time is smaller than the other of the two types of logs of the communication data, from a transmitter mounted on the vehicle to the outside of the vehicle An output unit that outputs a sampling log transmission instruction to periodically transmit to the server device provided in the server, and the output unit further acquires the abnormality detection result indicating that the communication data includes an abnormality When the device acquires the full log, which is a log in which the amount of data generated per unit time of the two types of logs is larger than the sampling log. The outputs the full log transmission instruction for transmitting to the server device from the vessel.

  As a result, a sampling log with a relatively small amount of data is periodically transmitted from a transmitter mounted on the vehicle to the server device, and a full log with a relatively large amount of data is transmitted in an abnormal state. Then, the server device provided outside the vehicle can monitor and analyze the sampling log and the full log by using sufficient processing capability that is not restricted by the requirements for in-vehicle use. Therefore, the information processing apparatus can reduce the data amount of the monitoring target data transmitted from the in-vehicle system while maintaining an appropriate monitoring level.

  For example, the acquisition device may acquire the abnormality detection result from the abnormality detector included in the server device.

  Thereby, the information processing apparatus can acquire the abnormality detection result from the abnormality detector included in the server apparatus that is the transmission destination of the sampling log. The abnormality detector included in the server device may have sufficient processing capability that is not limited by the requirements for in-vehicle use. Moreover, the abnormality detector included in the server device can determine whether an abnormality is included according to the sampling log. Therefore, the information processing apparatus can acquire an appropriate abnormality detection result from the abnormality detector included in the server apparatus.

  In addition, for example, the information processing apparatus further includes the abnormality detector, and the abnormality detector acquires the communication data from the in-vehicle network and determines whether the communication data includes an abnormality. May be.

  Thereby, the information processing apparatus can appropriately determine whether or not the communication data includes an abnormality in accordance with the communication data acquired from the in-vehicle network. Further, the information processing apparatus can control the transmitter such that the sampling log is periodically transmitted from the in-vehicle system and the full log is transmitted from the in-vehicle system when an abnormality occurs. Therefore, an abnormality or the like determined to be included in the communication data can be analyzed appropriately.

  Further, for example, the sampling log is a plurality of periods included in the plurality of sampling intervals, each of which is shorter than the first time length, among a plurality of sampling intervals each of which is a period of a first time length. The log of the communication data in a plurality of sampling periods that are periods of the second time length may be used.

  Thereby, the data amount of a sampling log is reduced appropriately. Therefore, the data amount of the monitoring target data transmitted from the in-vehicle system is appropriately reduced. In addition, since illegal data for illegally controlling a vehicle is likely to be transmitted continuously, abnormalities included in communication data may be caused by sampling logs in a plurality of sampling periods respectively included in a plurality of sampling intervals. Can be analyzed appropriately.

  In addition, for example, the sampling log includes (i) a sampling time of the frame, and (ii) one or more sampling periods having the same sampling period as the frame for each of the plurality of frames constituting the communication data in the plurality of sampling periods. Whether or not the frame is the first frame and (iii) data of the frame may be indicated.

  Thereby, for each frame, the sampling time and whether or not it is the first frame in the sampling period are indicated by the sampling log. For example, in the sampling period, an abnormality can be appropriately determined according to the difference between the sampling time of a frame different from the first frame and the sampling time of the previous frame.

  Further, for example, the full log is a log of the communication data of a plurality of types, the sampling log is a log of the communication data of one or more types less than the plurality of types, and the plurality of sampling periods For each of the plurality of frames constituting the one or more types of communication data in (i), (i) the sampling time of the frame, and (ii) the first frame in one or more frames having the same type and sampling period as the frame. And (iii) data of the frame may be indicated.

  Thereby, for each frame, the sampling time and whether or not it is the first frame in the same type and the same sampling period are indicated by the sampling log. For example, in the same type and the same sampling period, an abnormality can be appropriately determined according to the difference between the sampling time of a frame different from the first frame and the sampling time of the previous frame.

  Further, for example, the full log may be a log of the communication data of a plurality of types, and the sampling log may be a log of the communication data of one or more types less than the plurality of types.

  Thereby, the data amount of a sampling log is reduced appropriately. Therefore, the data amount of the monitoring target data transmitted from the in-vehicle system is appropriately reduced. Further, by reducing the plurality of types to one or more types, for example, a log of important types of communication data can be applied as a sampling log.

  In addition, for example, the information processing apparatus further includes the transmitter, and the transmitter transmits the sampling log to the server device according to the sampling log transmission instruction output from the output device, and the output device The full log may be transmitted to the server device in accordance with the full log transmission instruction output from the server.

  Thereby, the information processing apparatus can transmit the sampling log and the full log to the server apparatus in a timely manner.

  Further, for example, the transmitter reversibly compresses the sampling log in accordance with the sampling log transmission instruction output from the output device, transmits the compressed sampling log to the server device, and outputs the output device. The full log may be reversibly compressed in accordance with the full log transmission instruction output from the server, and the compressed full log may be transmitted to the server device.

  Thereby, the sampling log and the full log are compressed and transmitted. Therefore, the information processing apparatus can reduce the amount of monitoring target data transmitted from the in-vehicle system.

  Further, for example, the full log and the sampling log are generated by a log generator mounted on the vehicle, and the output unit sends the sampling log generated by the log generator from the transmitter to the server device. The sampling log transmission instruction to be periodically transmitted is output, and when the acquisition unit acquires the abnormality detection result indicating that the communication data includes abnormality, the full log generated by the log generator is The full log transmission instruction to be transmitted from the transmitter to the server device may be output.

  Thereby, the information processing apparatus can appropriately control the in-vehicle system so that the sampling log and the full log generated in the in-vehicle system are transmitted from the in-vehicle system to the server apparatus.

  Further, for example, the sampling log is a plurality of periods included in the plurality of sampling intervals, each of which is shorter than the first time length, among a plurality of sampling intervals each of which is a period of a first time length. The log of the communication data in a plurality of sampling periods, which is a period of a second time length, and the output device further changes the first time length in a range longer than the second time length to the log generator A change instruction to be output may be output.

  Thereby, the information processing apparatus can change the time length of the sampling interval related to the sampling log. Therefore, the information processing apparatus can include abnormalities that are not included in the fixed sampling interval in the sampling log.

  Further, for example, when the acquisition unit acquires the abnormality detection result indicating that the communication data includes an abnormality, the output unit causes the log generator to store the first time in a range longer than the second time length. The change instruction that shortens the length of one hour may be output.

  Thereby, the information processing apparatus can increase the data amount of the sampling log after an abnormal time. Further, the information processing apparatus can include an abnormality or the like that is not included in a long sampling interval in the sampling log.

  Further, for example, the output unit causes the log generator to increase the first time length when the acquisition unit does not acquire the abnormality detection result indicating that the communication data includes an abnormality. An instruction may be output.

  Thereby, the information processing apparatus can reduce the data amount of the sampling log when there is no abnormality.

  In addition, for example, the first time length is determined for each of a plurality of types related to the communication data, and the output device includes an abnormality in the communication data for one type of the plurality of types. When the acquisition unit acquires the abnormality detection result to be displayed, the log generator may output the change instruction to shorten the first time length for the one type in a range longer than the second time length. Good.

  Thereby, the information processing apparatus can increase the data amount of the sampling log for each type after the abnormality.

  In addition, for example, the first time length is determined for each of a plurality of types related to the communication data, and the output device includes an abnormality in the communication data for one type of the plurality of types. When the acquisition unit acquires the abnormality detection result indicating, the log generator outputs the change instruction to shorten the first time length for each of the plurality of types in a range longer than the second time length. May be.

  Thereby, the information processing apparatus can increase the data amount of the sampling log regardless of the type after the abnormality. Therefore, the information processing apparatus can include detailed information in the sampling log regardless of the type after the abnormality.

  Further, for example, when the acquisition unit does not acquire the abnormality detection result indicating that the communication data includes an abnormality, the output unit increases the first time length shortened to the log generator. The change instruction to be output may be output.

  Thereby, the information processing apparatus can reduce the increased data amount when there is no abnormality.

  Further, for example, the output device may output the change instruction that causes the log generator to randomly change the first time length in a range longer than the second time length.

  Thereby, the information processing apparatus can make it difficult to analyze the sampling interval. Therefore, the information processing apparatus can suppress a phenomenon in which an abnormality based on illegal data is not included in the sampling log.

  For example, the output device may output the change instruction that causes the log generator to linearly change the first time length in a range longer than the second time length.

  Thereby, the information processing apparatus can change the sampling interval in various ways. Therefore, the information processing apparatus can appropriately include an abnormality or the like that is not included in the fixed sampling interval in the sampling log.

  In addition, for example, the acquisition unit further acquires the change instruction of the first time length from the server device as an external instruction, and the output unit follows the external instruction acquired by the acquisition unit from the server device. The change instruction for causing the log generator to change the first time length in a range longer than the second time length may be output.

  As a result, the information processing apparatus can change the sampling interval in accordance with the instruction acquired from the server apparatus. Therefore, centralized control of the sampling interval is possible.

  Further, for example, the full log is a log of the communication data of a plurality of types, the sampling log is a log of the communication data of one or more types of the plurality of types, and the output device Specific information that causes the log generator to specify the one or more types may be output.

  Thereby, the data amount of a sampling log is reduced appropriately. Therefore, the data amount of the monitoring target data transmitted from the in-vehicle system is appropriately reduced. Further, by reducing the plurality of types to one or more types, for example, a log of important types of communication data can be applied as a sampling log. In addition, the information processing apparatus can specify an appropriate type to be applied to the sampling log.

  Further, for example, the information processing apparatus further includes the log generator, and the log generator acquires the communication data from the in-vehicle network and generates the full log and the sampling log according to the communication data. Also good.

  Thereby, the information processing apparatus can appropriately generate the sampling log and the full log according to the communication data acquired from the in-vehicle network.

  An information processing method according to an aspect of the present disclosure is an information processing method performed by an information processing device mounted on a vehicle, and an abnormality detection is performed to determine whether an abnormality is included in communication data in the in-vehicle network of the vehicle. An acquisition step of acquiring a result from an abnormality detector, and a transmitter in which a sampling log in which the amount of data generated per unit time is smaller than the other log among the two types of logs of the communication data is mounted on the vehicle An output step of outputting a sampling log transmission instruction for periodically transmitting to a server device provided outside the vehicle, wherein the output step further indicates that the communication data includes an abnormality When the detection result is acquired in the acquisition step, the amount of data generated per unit time of the two types of logs is the sampling. It may be an information processing method for outputting a full log transmission instruction to transmit to said server device a full log is larger logs than grayed from the transmitter.

  As a result, a sampling log with a relatively small amount of data is periodically transmitted from a transmitter mounted on the vehicle to the server device, and a full log with a relatively large amount of data is transmitted in an abnormal state. Then, the server device provided outside the vehicle can monitor and analyze the sampling log and the full log by using sufficient processing capability that is not restricted by the requirements for in-vehicle use. Therefore, the information processing apparatus that performs this information processing method can reduce the data amount of the monitoring target data transmitted from the in-vehicle system while maintaining an appropriate monitoring level.

  Further, these comprehensive or specific aspects may be realized by a non-transitory recording medium such as a system, an apparatus, a method, an integrated circuit, a computer program, or a computer-readable CD-ROM. The present invention may be realized by any combination of an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

  Hereinafter, embodiments will be specifically described with reference to the drawings. It should be noted that each of the embodiments described below shows a comprehensive or specific example. Numerical values, shapes, materials, components, arrangement positions and connection forms of components, steps, order of steps, and the like shown in the following embodiments are merely examples, and are not intended to limit the scope of the claims. In addition, among the constituent elements in the following embodiments, constituent elements that are not described in the independent claims indicating the highest concept are described as optional constituent elements.

(Embodiment)
[Multi-layer defense and remote monitoring]
FIG. 1 is a block diagram illustrating a configuration of a security system according to the present embodiment. The security system 100 illustrated in FIG. 1 includes a server device 300, an in-vehicle system 410, and the like. The in-vehicle system 410 is a system mounted on the vehicle 400, and includes a security ECU 440, other ECUs 451 and 452, and the like. The ECU is an electronic control unit (Electronic Control Unit), and is also called an engine control unit (Engine Control Unit).

  In the vehicle 400, the in-vehicle system 410 provides four layers of defense. The first layer is defense in an external communication device. The communication device outside the vehicle authenticates the communication destination and encrypts communication according to the situation. The external communication device is a head-up display 421, a telematics communication unit (TCU) 422, a V2X module 423, or an OBD (On-Board Diagnostics) module 424.

  For example, the head-up display 421 communicates with a BLUETOOTH (registered trademark) device or a USB device. The telematics communication unit 422 communicates with an external server or the like. The V2X module 423 communicates with infrastructure or the like. The OBD module 424 communicates with a diagnostic device outside the vehicle.

  In addition, in-vehicle communication devices such as the head-up display 421 that have sufficient computing resources, in addition to authentication and encryption, check the communication data received from the outside of the vehicle and perform filtering that passes only data that has been approved in advance. By doing so, we prevent intrusion of illegal data.

  The second layer is defense in the gateway device 430. The gateway device 430 is also called a network gateway, and connects a network to which an external communication device is connected to a control system network mounted on the vehicle 400. The control system network is also called an in-vehicle network, and is specifically a CAN. The gateway device 430 checks the communication data received from outside the vehicle and performs filtering to transfer only data that has been approved in advance to the control network, thereby preventing intrusion of unauthorized data.

  The third layer is a defense in the security ECU 440 arranged in the control system network. The security ECU 440 monitors communication data flowing in the control system network, identifies and invalidates illegal data based on the format, period, value change amount, and the like of the communication data. For example, the security ECU 440 may identify unauthorized data by matching communication data with a white list or rule. Further, the security ECU 440 may invalidate illegal data using a CAN error frame.

  The fourth layer is a defense in the ECUs 451 and 452 and the like. The ECUs 451 and 452 and the like are mounted so as to have tamper resistance. For example, the ECUs 451 and 452 and the like may check that the software program has not been tampered with by secure boot. Further, the ECUs 451 and 452 and the like may prevent the software program from being falsified by using a software program generated by secure coding or a software program whose source code is obfuscated.

  Furthermore, in addition to the defense-in-depth in the in-vehicle system 410, the security system 100 also performs remote monitoring of the vehicle 400 in the server device 300.

  For example, due to the advancement of illegal data intrusion methods, there is a possibility that unauthorized data may enter through the defense in depth. Therefore, the server device 300 may detect unauthorized data that has entered through the defense-in-depth. And a new defense measure may be applied and a warning may be notified to a driver. Even when unauthorized data is dealt with by multi-layered defense, detecting unauthorized access as an abnormality and grasping the tendency of unauthorized access is useful to prevent intrusion of new unauthorized data.

  Therefore, for example, the server device 300 collects and analyzes a communication log that is a log of communication data in the in-vehicle network. Furthermore, the server apparatus 300 outside the vehicle 400 can collect and analyze many communication logs not only from one vehicle 400 but also from a plurality of vehicles. Then, communication logs obtained from various vehicles in various regions can be used to unify various vehicle abnormalities. Therefore, the area, time zone, vehicle type, etc. where unauthorized access is frequently performed can be specified.

  Moreover, the server apparatus 300 outside the vehicle 400 is not restricted by the requirements for in-vehicle use, and can be provided with abundant computing resources. Therefore, the server apparatus 300 outside the vehicle 400 can perform complicated processing such as advanced abnormality detection based on machine learning, for example. Therefore, the server apparatus 300 can detect unauthorized data, unauthorized access, or a sign thereof that the in-vehicle system 410 cannot detect.

  Server apparatus 300 outside vehicle 400 can perform processing corresponding to SIEM (Security Information Event Management) for collecting and analyzing information. This process can also be expressed as Auto SIEM (Automatic SIEM).

  In addition, for example, an SOC (Security Operation Center) and an ASIRT (Automatic Security Incident Response Team) may exist as organizations that operate the security system 100. The SOC is an organization that monitors the detection result in the server apparatus 300, and the ASIRT is an organization that deals with an abnormality when an abnormality is detected.

  For example, the ASIRT creates a new detection rule when the server apparatus 300 detects an abnormality that has not been detected by the defense-in-depth. Then, the server apparatus 300 may distribute the created new detection rule to the head-up display 421, the security ECU 440, and the like.

  The terminal device 200 connected to the server device 300 is a device that communicates with the server device 300, and is used in SOC, ASIRT, or the like. For example, the terminal device 200 receives an abnormality notification from the server device 300.

[Reduction of data volume]
As described above, the communication log is collected and analyzed by the server device 300. Therefore, the in-vehicle system 410 in the vehicle 400 uploads the communication log to the server device 300. The server device 300 accumulates and analyzes the uploaded communication log. Further, for example, the SOC and ASIRT download the communication log from the server device 300 to the terminal device 200 for detailed analysis and evidence maintenance. That is, the terminal device 200 downloads a communication log from the server device 300 in accordance with instructions such as SOC and ASIRT.

  However, the larger the amount of communication log data uploaded to the server device 300, the larger the resources used for communication, storage, analysis, and the like.

  For example, the bit rate of CAN is about 500 Kbps to 1 Mbps. If the CAN bit rate is 500 Kbps, the data volume of the CAN communication log is assumed to reach 225 MB in one hour even if overhead such as additional information is excluded. If 10,000 vehicles upload the communication log to the server device 300, the data amount of the communication log uploaded to the server device 300 is assumed to reach 2250 GB in one hour.

  It is not easy to prepare a large resource corresponding to such a large amount of data. Therefore, the security system 100 according to the present embodiment includes a configuration for reducing the data amount of the monitoring target data transmitted from the in-vehicle system 410 to the server device 300 while maintaining an appropriate monitoring level.

  Further, the operation log of each in-vehicle device in the in-vehicle system 410 may be transmitted from the in-vehicle system 410 to the server device 300 as monitoring target data. In the present embodiment, in particular, a communication log of the in-vehicle network is transmitted from the in-vehicle system 410 to the server device 300 as monitoring target data.

  In unauthorized access to the vehicle 400, there is a high possibility that unauthorized data flows through the in-vehicle network. Therefore, the communication log is useful for monitoring for protecting the vehicle 400 from unauthorized access. On the other hand, the amount of data in the communication log of CAN, which is an in-vehicle network widely adopted in various vehicles, is assumed to be large as described above. That is, the communication log is useful for monitoring, but the amount of data is large.

  Therefore, the security system 100 according to the present embodiment particularly reduces the data amount of the communication log transmitted from the in-vehicle system 410 to the server device 300. The security system 100 may further reduce the data amount of the operation log transmitted from the in-vehicle system 410 to the server device 300 using the same method.

  The security system 100 uses three reduction methods for reducing the amount of monitoring target data transmitted from the in-vehicle system 410 to the server device 300. Here, the monitoring target data whose data amount is reduced is specifically a communication log transmitted from the in-vehicle system 410 to the server device 300.

  The first reduction method is type reduction. Specifically, only the data frame of the high importance type among all the data frames of the type flowing through the CAN is included in the monitoring target data transmitted from the in-vehicle system 410 to the server device 300. For example, among various types of communication data flowing through CAN, communication data such as an accelerator or a brake is directly related to the behavior of the vehicle, but communication data such as a window or a wiper is not directly related to the behavior of the vehicle.

  Therefore, only communication data directly related to the behavior of the vehicle among various types of communication data flowing through the CAN is included in the monitoring target data transmitted from the in-vehicle system 410 to the server device 300 as highly important communication data. . For example, when only 20 types of data that are directly related to the behavior of the car among all 100 types of data flowing through the CAN are included in the monitoring target data, about 80% of the total 100 types of data is reduced. Is expected. In CAN, the type corresponds to an ID included in a data frame.

  The second reduction method is thinning out the period. Specifically, communication data in a plurality of sampling periods respectively included in a plurality of sampling intervals is included in monitoring target data transmitted from the in-vehicle system 410 to the server device 300.

  FIG. 2 is a schematic diagram showing a sampling period used in the security system 100 shown in FIG. In FIG. 2, the sampling period T2 is shorter than the sampling interval T1. Of the communication data at the sampling interval T1, communication data at the sampling period T2 is included in the monitoring target data transmitted from the in-vehicle system 410 to the server device 300. Thereby, (1-T2 / T1) × 100% of the data amount is reduced.

  The sampling period T2 may be defined according to the minimum number of data frames for detecting an abnormality in the server apparatus 300. For example, when at least K data frames are used in the abnormality detection algorithm in the server apparatus 300, the sampling period T2 is defined such that at least K data frames exist in the sampling period T2.

  Specifically, when the abnormality detection algorithm determines the presence or absence of an abnormality for each single data frame, the above K is 1. Accordingly, in this case, a period corresponding to one period of the same kind of data frame periodically flowing through the CAN can be defined as the sampling period T2.

  Further, the sampling interval T1 may be defined to be shorter than a period in which illegal data is continuously invaded. For example, in CAN, the influence of each data frame that flows once on the vehicle 400 is small, and the influence of a plurality of data frames that flow continuously on the vehicle 400 is large. That is, the influence of a single intrusion of illegal data on the vehicle 400 is small, and the influence of the continuous intrusion of illegal data on the vehicle 400 is large.

  Therefore, for example, when it is assumed that the period during which unauthorized data is continuously intruded is 5 seconds, the sampling interval T1 may be defined to be shorter than 5 seconds. As a result, abnormal data that flows through CAN due to the intrusion of unauthorized data is included in the monitoring target data. In addition, when it is assumed that the period during which unauthorized data is continuously intruded is long, the sampling interval T1 may be defined to be long. Therefore, in this case, the data amount reduction effect is great.

  If it is difficult to assume a period in which unauthorized data is continuously invaded, the sampling interval T1 may be dynamically changed. The sampling interval T1 may be randomly changed at the acquisition timing of the communication log, or may be changed for each vehicle type, region, or type. Thereby, there is a high possibility that the abnormal data flowing through the CAN due to the intrusion of unauthorized data is included in the monitoring target data transmitted from the in-vehicle system 410 to the server device 300.

  By appropriately defining the sampling interval T1 and the sampling period T2, abnormal data flowing through the CAN is included in the monitoring target data transmitted to the server device 300, and the monitoring target data transmitted to the server device 300 is Reduced.

  The third reduction method is data compression. Specifically, the in-vehicle system 410 reduces the data amount of the monitoring target data transmitted to the server apparatus 300 by compressing the monitoring target data according to a data compression method such as zip, gzip, or 7-Zip. Also good.

  Regarding data compression, various data compression methods are implemented in various software programs for personal computers and are widely used. For example, for a binary file, the data amount can be reduced by about 30 to 60% by data compression. Regarding the monitoring target data similar to the binary file, the data amount can be reduced by the data compression. As a result of actually compressing the monitoring target data, the data amount was reduced by 69.4%.

  FIG. 3 is a comparison diagram of sampling logs and full logs used in the security system 100 shown in FIG. Each of the sampling log and the full log is a CAN communication log and is monitoring target data. The three reduction methods described above are applied to the sampling log. That is, the type reduction, period thinning, and data compression are applied to the sampling log. Of the three reduction methods described above, only the data compression is applied to the full log.

  The sampling log includes only a part of all communication logs of CAN. Therefore, the data amount of the sampling log is relatively small. In addition, the sampling log can include a minimum amount of data for detecting an abnormality included in the communication data.

  The full log basically includes all communication logs of CAN. Therefore, the data amount of the full log is relatively large. However, the full log may include detailed information regarding CAN communication data. That is, the full log can indicate the abnormality included in the communication data in detail.

  The security system 100 appropriately uses two types of monitoring target data, that is, a sampling log and a full log. That is, the security system 100 selectively uses the sampling log and the full log.

  Specifically, the security system 100 generates a sampling log for normal monitoring. Then, the security system 100 periodically transmits a sampling log from the in-vehicle system 410 to the server device 300. In addition, the security system 100 generates a full log for detailed analysis and evidence maintenance when an abnormality is detected. And the security system 100 transmits a full log from the vehicle-mounted system 410 to the server apparatus 300 at the time of abnormality detection.

  By transmitting a full log when an abnormality is detected, appropriate detailed analysis and evidence preservation are possible. On the other hand, since it is assumed that the frequency of occurrence of abnormality is low, the data amount of the monitoring target data transmitted from the in-vehicle system 410 to the server device 300 can approximate the data amount of the sampling log. Therefore, the data amount of the monitoring target data transmitted from the in-vehicle system 410 to the server device 300 is small. Thereby, the fall of a monitoring level is suppressed and the data amount of the monitoring object data transmitted to the server apparatus 300 from the vehicle-mounted system 410 is reduced.

  FIG. 4 is a data configuration diagram showing a log format used in the security system 100 shown in FIG. The sampling log and the full log are transmitted from the in-vehicle system 410 to the server device 300 in the log format shown in FIG.

  Specifically, the vehicle ID, time stamp, length, version, and reservation are included in the header portion of the log format. Furthermore, N sets each composed of a flag, reservation, ID, DLC (data length code), time stamp, and data set are included in the payload portion of the log format.

  The vehicle ID in the header portion indicates an identifier for identifying the vehicle 400 from a plurality of vehicles. The time stamp in the header portion indicates the time when the communication log is transmitted as a sampling log or a full log. The length in the header portion indicates the length of the payload portion. The version in the header part indicates the version of the log format. The reservation in the header part is an unused area in the header part.

  The flag in the payload portion indicates whether or not the data in the set including the flag is data of the first frame in the sampling period. That is, this flag indicates whether previous data is missing. This flag may indicate whether the data in the set including the flag is data of the first frame in the same type and the same sampling period.

  The reservation in the payload part is an unused area in the payload part. The ID in the payload portion is an ID in the CAN frame and indicates the type of communication data. The DLC in the payload portion is a DLC in the CAN frame and indicates the length of data in the payload portion. The time stamp in the payload portion indicates a sampling time that is a time when a CAN frame is acquired from the CAN in-vehicle network. Data in the payload portion is data in a CAN frame.

  The sampling log and the full log may further include an identification flag for identifying the sampling log or the full log. For example, such an identification flag is included in the header portion of the log format.

  The inventor evaluated the reduction amount of the monitoring target data based on the sampling log and the full log as described above. Specifically, the amount of reduction was evaluated by measuring the data amount of each of the communication log, sampling log, and full log for the actual communication data of CAN for one minute. The communication log in the evaluation is a log whose data amount is not reduced, and is the same as the full log before compression. The data amount of the communication log was 1158 KB.

  First, the type reduction was applied. Specifically, out of about 100 types of communication data in CAN, four types of communication data, such as steering, accelerator, brake, and vehicle speed, which are deeply related to vehicle control, were used to generate a sampling log. The data amount of the sampling log to which the type reduction is applied is 200 KB. That is, the data amount was reduced by 82.7% compared with the data amount of the original communication log.

  Next, in addition to the type reduction, period thinning was applied. At that time, the time length of the sampling period was fixed at 72 ms, and the data amount of the sampling log of the communication data was measured while changing the time length of the sampling interval.

  FIG. 5 is a graph showing the relationship between the sampling interval and the data amount of the sampling log. As shown in FIG. 5, the sampling interval and the data amount of the sampling log have a relationship that the longer the sampling interval, the smaller the data amount of the sampling log. In this evaluation, a sampling interval of 1 second was finally adopted. As a result, the data amount of the sampling log to which decimation was applied was 14.4 KB. That is, the data amount was reduced by 92.8% from 200 KB to 14.4 KB.

  In addition, data compression was applied. Specifically, the sampling log was compressed using each of the seven compression methods of zip, cab, gzip, bzip2, lzh, and 7-Zip, and the amount of data after compression was compared.

  FIG. 6 is a comparison diagram showing the amount of data before and after compression. Here, the first to fourth types correspond to four types of steering, accelerator, brake, and vehicle speed. As shown in FIG. 6, the compression method having the highest compression effect is 7-Zip, and the data amount of the sampling log compressed by 7-Zip was 4.4 KB. That is, the data amount was reduced by 69.4% from 14.4 KB to 4.4 KB.

  In the second type and fourth type data, the value of 0 was more continuous than in the first type and third type data. Therefore, it is presumed that a high compression effect is obtained in the second and fourth type data.

  The 4.4KB sampling log was finally generated by reducing the type, thinning out the period, and compressing. That is, the data amount of 99.6% was reduced from 1158 KB to 4.4 KB.

  In addition, the data amount of the communication log compressed using 7-Zip, more specifically, the data amount of the full log compressed using 7-Zip was 462 KB. That is, for the full log, the data amount was reduced by 60.1% from 1158 KB to 462 KB.

  As described above, an evaluation result was obtained that the data amount was reduced in both the sampling log and the full log, and the data amount was reduced in the sampling log as compared to the full log. Since the sampling log is transmitted from the in-vehicle system 410 to the server device 300 at normal times, it is expected that the amount of monitoring target data transmitted from the in-vehicle system 410 to the server device 300 is appropriately reduced.

[Basic configuration]
Next, a basic configuration for reducing the amount of monitoring target data transmitted from the in-vehicle system 410 while maintaining an appropriate monitoring level will be described.

  FIG. 7 is a block diagram showing a basic configuration of security ECU 440 in the present embodiment. Security ECU 440 is an example of an information processing device mounted on vehicle 400. The security ECU 440 includes an acquisition unit 441 and an output unit 442.

  The acquisition unit 441 acquires information. Specifically, the acquisition unit 441 acquires from the abnormality detector 510 an abnormality detection result as to whether or not an abnormality is included in the communication data in the in-vehicle network of the vehicle 400.

  The output device 442 outputs information. Specifically, the output unit 442 outputs a sampling log transmission instruction for periodically transmitting a sampling log from the transmitter 530 mounted on the vehicle 400 to the server device 300 outside the vehicle 400. Further, when an abnormality detection result indicating that abnormality is included in the communication data is acquired, the output unit 442 outputs a full log transmission instruction for transmitting a full log from the transmitter 530 to the server device 300.

  Here, the sampling log is a log in which the amount of data generated per unit time is smaller than the other log among the two types of logs of communication data. The full log is a log in which the amount of data generated per unit time is larger than the sampling log among the two types of logs.

  For example, the full log may be a log of a plurality of types of communication data. The sampling log may be a log of one or more types of communication data that is smaller than a plurality of types related to the full log.

  The sampling log may be a log of communication data in a plurality of sampling periods respectively included in a plurality of sampling intervals among a plurality of sampling intervals. Here, each of the plurality of sampling intervals is a period of a first time length. Each of the plurality of sampling periods is a period of a second time length shorter than the first time length.

  In addition, the sampling log includes, for each frame constituting communication data in a plurality of sampling periods, (i) the sampling time of the frame, (ii) whether the frame is the first frame, and (iii) the frame Frame data may be indicated. Here, whether or not the frame is the first frame is, for example, whether or not the frame is the first frame in one or more frames having the same sampling period as the frame.

  In addition, the sampling log includes (i) the sampling time of the frame and (ii) whether the frame is the first frame for each of a plurality of frames constituting one or more types of communication data in a plurality of sampling periods. Or (iii) data of the frame may be indicated. Here, whether or not the frame is the first frame is, for example, whether or not the frame is the first frame in one or more frames having the same type and sampling period as the frame.

  Further, for example, the log generator 520 acquires communication data from the in-vehicle network, and generates a full log and a sampling log according to the communication data. The log generator 520 is not limited to directly acquiring communication data from the in-vehicle network, and may indirectly acquire communication data from the in-vehicle network via another device. For example, the log generator 520 may acquire communication data from the in-vehicle network via a memory in which communication data is stored. Further, the log generator 520 may be included in the security ECU 440.

  The output unit 442 may output a sampling log transmission instruction for periodically transmitting the sampling log generated by the log generator 520 from the transmitter 530 to the server apparatus 300. When an abnormality detection result indicating that the communication data includes an abnormality is acquired, the output unit 442 transmits a full log transmission instruction to transmit the full log generated by the log generator 520 from the transmitter 530 to the server device 300. It may be output.

  Further, the output unit 442 may output a change instruction for causing the log generator 520 to change the first time length related to the sampling interval in a range longer than the second time length related to the sampling period.

  For example, when an abnormality detection result indicating that the communication data includes an abnormality is acquired, the output unit 442 instructs the log generator 520 to change the first time length within a range longer than the second time length. It may be output. And when the abnormality detection result which shows that abnormality is contained in communication data is not acquired, the output device 442 may output the change instruction | indication which makes log generator 520 lengthen 1st time length.

  For example, the first time length may be determined for each of a plurality of types related to communication data. When an abnormality detection result indicating that abnormality is included in the communication data for one type is acquired, the output unit 442 causes the log generator 520 to output the first time for the type within a range longer than the second time length. A change instruction for shortening the length may be output.

  Alternatively, when an abnormality detection result indicating that an abnormality is included in communication data for one type is acquired, the output unit 442 causes the log generator 520 to store each of a plurality of types within a range longer than the second time length. A change instruction for shortening the first time length may be output. In other words, in this case, the output unit 442 may output a change instruction for shortening the first time length for all types to the log generator 520 in a range longer than the second time length.

  And when the abnormality detection result which shows that abnormality is contained in communication data is not acquired, the output device 442 may output the change instruction which lengthens the 1st time length shortened to the log generator 520. Good.

  For example, the output device 442 may output a change instruction that causes the log generator 520 to randomly change the first time length in a range longer than the second time length. The output unit 442 may output a change instruction for causing the log generator 520 to linearly change the first time length in a range longer than the second time length.

  Further, for example, the acquisition unit 441 may acquire a change instruction for the first time length from the server device 300 as an external instruction. Then, the output unit 442 may output a change instruction that causes the log generator 520 to change the first time length in a range longer than the second time length in accordance with the external instruction acquired from the server device 300.

  For example, the output device 442 may output specific information that causes the log generator 520 to specify one or more types related to the sampling log.

  In addition, the abnormality detector 510 may be included in the server device 300. Then, the acquisition unit 441 may acquire an abnormality detection result from the abnormality detector 510 included in the server device 300.

  Further, the abnormality detector 510 may be included in the security ECU 440. And the abnormality detector 510 may acquire communication data from a vehicle-mounted network, and may determine whether abnormality is contained in communication data. The abnormality detector 510 is not limited to directly acquiring communication data from the in-vehicle network, and may indirectly acquire communication data from the in-vehicle network via another device. For example, the abnormality detector 510 may acquire a full log or the like generated from the communication data of the in-vehicle network via the log generator 520 as communication data.

  Further, for example, the transmitter 530 transmits the sampling log to the server device 300 according to the sampling log transmission instruction output from the output device 442, and transmits the full log to the server device 300 according to the full log transmission instruction output from the output device 442. Send. The transmitter 530 may be included in the security ECU 440.

  Further, the transmitter 530 may reversibly compress the sampling log in accordance with the sampling log transmission instruction output from the output unit 442 and transmit the compressed sampling log to the server apparatus 300. Further, the transmitter 530 may reversibly compress the full log in accordance with the full log transmission instruction output from the output unit 442, and transmit the compressed full log to the server device 300.

  Further, the output unit 442 periodically outputs a sampling log transmission instruction for periodically transmitting a sampling log from the transmitter 530 to the server apparatus 300, thereby periodically outputting the sampling log from the transmitter 530 to the server apparatus 300. It may be transmitted. Alternatively, the output unit 442 periodically outputs a sampling log transmission instruction for transmitting a sampling log from the transmitter 530 to the server apparatus 300 as a single instruction, thereby periodically sampling from the transmitter 530 to the server apparatus 300. A log may be sent.

  For example, when it is determined that the communication data includes an abnormality, the abnormality detector 510 transmits an abnormality detection result indicating that the communication data includes an abnormality, and the acquisition unit 441 transmits the abnormality detection result. You may get it. If it is determined that no abnormality is included in the communication data, the abnormality detector 510 does not transmit the abnormality detection result, and the acquisition unit 441 does not have to acquire the abnormality detection result. Alternatively, in this case, the abnormality detector 510 may transmit an abnormality detection result indicating that the communication data does not include an abnormality, and the acquisition unit 441 may acquire the transmitted abnormality detection result.

  Note that the acquisition unit 441 and the output unit 442 may be dedicated or general-purpose electric circuits. The security ECU 440, the abnormality detector 510, the log generator 520, the transmitter 530, and the server device 300 may be configured by an electric circuit. Specifically, each of these may be a computer.

  Further, as described above, the abnormality detector 510, the log generator 520, and the transmitter 530 may be included in the security ECU 440, respectively. The acquisition unit 441 may acquire information from a device inside the security ECU 440, and the output unit 442 may output information to a device inside the security ECU 440.

  Further, each of the abnormality detector 510, the log generator 520, and the transmitter 530 may be an ECU connected to the in-vehicle network. The transmitter 530 may be a device corresponding to the telematics communication unit 422, the V2X module 423, the gateway device 430, or the like shown in FIG. The acquisition unit 441 may acquire information from a device external to the security ECU 440 via a vehicle-mounted network, and the output unit 442 may output information to a device external to the security ECU 440 via the vehicle-mounted network. .

  Furthermore, the acquisition unit 441 may acquire information from a device external to the security ECU 440 via a network different from the in-vehicle network. The output unit 442 may output information to a device outside the security ECU 440 via a network different from the in-vehicle network.

  FIG. 8 is a block diagram showing a basic configuration of server apparatus 300 in the present embodiment. Server device 300 is an example of an information processing device provided outside vehicle 400. The server device 300 includes an acquisition unit 301, a determination unit 302, and an output unit 303.

  The acquisition unit 301 acquires information. Specifically, the acquisition unit 301 acquires a sampling log from the in-vehicle system 410 of the vehicle 400.

  The determiner 302 performs a determination process. Specifically, the determiner 302 determines whether or not the communication data includes an abnormality using the sampling log.

  The output device 303 outputs information. Specifically, when the output device 303 determines that the communication data includes an abnormality, the output device 303 indicates that the communication data includes an abnormality as a transmission instruction for transmitting the full log from the in-vehicle system 410 to the server device 300. The detection result is output to the in-vehicle system 410.

  As described above, the sampling log is a log in which the amount of data generated per unit time is smaller than the other log among the two types of logs of communication data in the in-vehicle network of the vehicle 400. The full log is a log in which the amount of data generated per unit time is larger than the sampling log among the two types of logs.

  Further, for example, the full log may be a log of a plurality of types of communication data. The sampling log may be a log of one or more types of communication data that is smaller than a plurality of types related to the full log.

  The sampling log may be a log of communication data in a plurality of sampling periods respectively included in a plurality of sampling intervals among a plurality of sampling intervals. Here, each of the plurality of sampling intervals is a period of a first time length. Each of the plurality of sampling periods is a period of a second time length shorter than the first time length.

  The output device 303 may output to the in-vehicle system 410 a change instruction for causing the in-vehicle system 410 that generates the sampling log as described above to change the first time length in a range longer than the second time length. For example, when it is determined that the communication data includes an abnormality, the output device 303 may output a change instruction that causes the in-vehicle system 410 to shorten the first time length in a range longer than the second time length. Further, when it is determined that the communication data does not include an abnormality, the output device 303 may output a change instruction for causing the in-vehicle system 410 to increase the first time length.

  For example, the first time length may be determined for each of a plurality of types related to communication data. When the output device 303 determines that the communication data includes an abnormality for one type, the output device 303 instructs the in-vehicle system 410 to change the first time length for the type in a range longer than the second time length. It may be output.

  Alternatively, when it is determined that the communication data includes an abnormality for one type, the output device 303 causes the in-vehicle system 410 to shorten the first time length for each of the plurality of types within a range longer than the second time length. A change instruction may be output. That is, in this case, the output device 303 may output a change instruction for shortening the first time length for all types to the in-vehicle system 410 in a range longer than the second time length.

  Further, when it is determined that the communication data does not include an abnormality, the output device 303 may output a change instruction for increasing the first time length shortened by the in-vehicle system 410.

  Further, the output device 303 may output the change instruction as described above to a plurality of in-vehicle systems of a plurality of vehicles having the same vehicle type as the vehicle 400. The output device 303 may output the change instruction to a plurality of in-vehicle systems of a plurality of vehicles having the same area as the vehicle 400.

  In addition, the sampling log includes, for each frame constituting communication data in a plurality of sampling periods, (i) the sampling time of the frame, (ii) whether the frame is the first frame, and (iii) the frame Frame data may be indicated. Here, whether or not the frame is the first frame is, for example, whether or not the frame is the first frame in one or more frames having the same sampling period as the frame.

  Then, when the frame is not the first frame in one or more frames having the same sampling period as that frame, the determiner 302 includes an abnormality in the communication data using at least one of the sampling time difference and the data difference. It may be determined whether or not.

  Here, the difference in sampling time is the difference between the sampling time of the frame before the frame and the sampling time of the frame among one or more frames having the same sampling period as the frame. The data difference is a difference between the data of the previous frame and the data of the frame. Here, the previous frame is, for example, the immediately preceding frame.

  In addition, the sampling log includes (i) the sampling time of the frame and (ii) whether the frame is the first frame for each of a plurality of frames constituting one or more types of communication data in a plurality of sampling periods. Or (iii) data of the frame may be indicated. Here, whether or not the frame is the first frame is, for example, whether or not the frame is the first frame in one or more frames having the same type and sampling period as the frame.

  If the frame is not the first frame in one or more frames having the same type and sampling period as the relevant frame, the determination unit 302 uses at least one of the sampling time difference and the data difference to indicate that the communication data is abnormal. You may determine whether it is contained.

  Here, the difference in sampling time is the difference between the sampling time of a frame before the frame and the sampling time of the frame among one or more frames having the same type and sampling period as the frame. The data difference is a difference between the data of the previous frame and the data of the frame.

  Further, the acquisition unit 301 may acquire a full log from the in-vehicle system 410 after outputting the transmission instruction. Then, the determiner 302 may further determine whether the communication data includes an abnormality using the full log.

  The output device 303 may output the abnormality detection result to the in-vehicle system 410 when it is determined that the communication data includes an abnormality using the sampling log. The output device 303 may not output the abnormality detection result to the in-vehicle system 410 when it is determined that the communication data includes an abnormality using the full log. That is, the output device 303 may output an abnormality detection result to the in-vehicle system 410 when it is determined that an abnormality is included in the communication data when the full log is not acquired.

  Further, the output device 303 may output an abnormality detection result to the terminal device 200 when it is determined that the communication data includes an abnormality.

  Further, the acquisition unit 301 may acquire the sampling log compressed in the in-vehicle system 410 from the in-vehicle system 410 and decompress the compressed sampling log. Similarly, the acquisition unit 301 may acquire the full log compressed in the in-vehicle system 410 from the in-vehicle system 410 and decompress the compressed full log.

  Note that the acquisition unit 301, the determination unit 302, and the output unit 303 may be dedicated or general-purpose electric circuits. And the terminal device 200, the server apparatus 300, and the vehicle-mounted system 410 may be comprised with the electric circuit. Specifically, each of these may be a computer. Further, the acquisition unit 301 may acquire information from an external device of the server device 300 via an external network, and the output device 303 outputs information to an external device of the server device 300 via the external network. May be.

  For example, the average data amount of the sampling log generated per unit time is smaller than the average data amount of the full log generated per unit time. The unit time may be 1 second, 1 minute, 1 hour, or a sampling interval related to the sampling log.

[Concrete example]
FIG. 9 is a block diagram showing a configuration of the security system 100 in a specific example of the present embodiment.

  In this specific example, the security system 100 includes a terminal device 200, a server device 300, a gateway device 430, a security ECU 440, and a plurality of ECUs 450. The security system 100, the terminal device 200, the server device 300, the gateway device 430, and the security ECU 440 illustrated in FIG. 9 respectively correspond to the components illustrated in FIG. Further, the plurality of ECUs 450 shown in FIG. 9 correspond to the plurality of ECUs 451 and 452 shown in FIG.

  Gateway device 430, security ECU 440, and a plurality of ECUs 450 are connected to the in-vehicle network. Server device 300 is connected to terminal device 200 and an external network. The server device 300 may be connected to the terminal device 200 via an external network. The external network and the in-vehicle network are connected to each other via the gateway device 430. The gateway device 430 relays communication between the in-vehicle network and the external network.

  For example, the gateway device 430 is wirelessly connected to an external network. The gateway device 430 may be connected to an external network via the telematics communication unit 422 or the V2X module 423 shown in FIG. The external network may be a wireless communication network or a wired communication network.

  The security ECU 440, the server device 300, and the terminal device 200 have a role of protecting the vehicle 400, the in-vehicle network, and the like from unauthorized access.

  Security ECU 440 directly monitors communication data in the in-vehicle network. The server device 300 performs remote monitoring by indirectly monitoring communication data in the in-vehicle network. The terminal device 200 acquires the remote monitoring result and the like from the server device 300. The terminal device 200 is used in a monitoring organization such as SOC or ASIRT.

  FIG. 10 is a block diagram showing a modified configuration of the security system 100 shown in FIG. In this modified configuration, the gateway device 430 and the security ECU 440 of FIG. 9 are integrated. The security system 100 includes a security gateway device 460 in which the gateway device 430 and the security ECU 440 are integrated.

  The security gateway device 460 may be the security ECU 440 including the gateway device 430, or may be the gateway device 430 including the security ECU 440.

  FIG. 11 is a block diagram showing a configuration of security ECU 440 shown in FIG. The security ECU 440 includes a sampling log generator 443, a full log generator 444, an abnormality detector 445, an abnormal data invalidator 446, an accumulator 447, and a communication device 448. These components serve as the acquisition unit 441, the output unit 442, the abnormality detector 510, the log generator 520, the transmitter 530, and the like shown in FIG.

  The sampling log generator 443 acquires communication data in the in-vehicle network via the communication device 448, generates a sampling log of the acquired communication data, and stores the generated sampling log in the accumulator 447.

  The full log generator 444 acquires communication data in the in-vehicle network via the communication device 448, generates a full log of the acquired communication data, and stores the generated full log in the accumulator 447.

  The abnormality detector 445 acquires communication data in the in-vehicle network via the communication device 448 and determines whether the acquired communication data includes an abnormality. The abnormality detector 445 may determine whether or not the communication data includes an abnormality by determining whether or not the full log stored in the accumulator 447 includes an abnormality. Alternatively, the abnormality detector 445 may simply determine whether or not the communication data includes an abnormality by determining whether or not the sampling log stored in the accumulator 447 includes the abnormality. .

  The abnormal data invalidator 446 invalidates abnormal communication data when it is determined that the communication data includes an abnormality. Specifically, the abnormal data invalidator 446 may invalidate abnormal communication data by outputting a CAN error frame to the in-vehicle network via the communication device 448.

  The accumulator 447 accumulates the sampling log generated by the sampling log generator 443 and the full log generated by the full log generator 444. For example, the accumulator 447 is configured with a memory.

  The communication device 448 communicates with a plurality of ECUs 450, the gateway device 430, and the like by acquiring information from the in-vehicle network and outputting the information to the in-vehicle network. Further, the communication device 448 may communicate with the server device 300 or the like via the gateway device 430.

  Note that the acquisition unit 441, the output unit 442, and the transmitter 530 illustrated in FIG. The abnormality detector 510 illustrated in FIG. 7 may be included in the abnormality detector 445. The log generator 520 illustrated in FIG. 7 may include a sampling log generator 443, a full log generator 444, and an accumulator 447.

  For example, in the communication device 448, the output device 442 may output a transmission instruction for periodically transmitting the sampling log to the transmitter 530. Then, the acquisition device 441 included in the communication device 448 may acquire from the abnormality detector 445 an abnormality detection result indicating whether the communication data includes an abnormality. Then, in the communication device 448, when an abnormality detection result for acquiring that communication data includes an abnormality is acquired, the output device 442 may output a transmission instruction for transmitting the full log to the transmitter 530. .

  Further, for example, the output device 442 included in the communication device 448 may output an instruction regarding the sampling interval or type to the sampling log generator 443 constituting the log generator 520.

  The above relationship between the components shown in FIG. 7 and the components shown in FIG. 11 is an example, and these relationships are not limited to the above examples. For example, the acquisition unit 441 and the output unit 442 illustrated in FIG. 7 may be included in the abnormality detector 445. In the abnormality detector 445, the acquisition unit 441 acquires an abnormality detection result indicating whether or not the communication data includes an abnormality from the abnormality detector 510 that determines whether or not the communication data includes an abnormality. Also good.

  FIG. 12 is a block diagram showing a configuration of the security gateway device 460 shown in FIG. The security gateway device 460 includes a sampling log generator 463, a full log generator 464, an abnormality detector 465, an abnormal data invalidator 466, an accumulator 467, a transfer processor 469, an external communication device 470, and an in-vehicle communication device 471. These components serve as the acquisition unit 441, the output unit 442, the abnormality detector 510, the log generator 520, the transmitter 530, and the like shown in FIG.

  In addition, the sampling log generator 463, the full log generator 464, the abnormality detector 465, the abnormality data invalidator 466, and the accumulator 467 in FIG. 12 are respectively the sampling log generator 443, the full log generator 444, and the abnormality in FIG. It is the same component as the detector 445, the abnormal data invalidator 446, and the accumulator 447.

  The transfer processor 469 acquires information from the outside of the vehicle 400 via the external communication device 470 and outputs the information via the in-vehicle communication device 471 to transfer the information from the outside of the vehicle 400 to the inside. Further, the transfer processor 469 acquires information from the inside of the vehicle 400 via the in-vehicle communication device 471, and outputs the information to the outside of the vehicle 400 via the external communication device 470, so Transfer information to.

  The external communication device 470 communicates with the server device 300 outside the vehicle 400, for example, via an external network. The in-vehicle communication device 471 communicates with a plurality of ECUs 450 and the like inside the vehicle 400 via an in-vehicle network. Further, the outside communication device 470 and the inside communication device 471 play the same role as the communication device 448 of the security ECU 440.

  The operation of the security ECU 440 described below may be performed by the security gateway device 460. For example, the operation performed by the communication device 448 of the security ECU 440 may be performed by the vehicle communication device 470 or the vehicle communication device 471 of the security gateway device 460.

  As an example, the acquisition device 441, the output device 442, and the transmitter 530 illustrated in FIG. 7 may be included in the external communication device 470. The abnormality detector 510 shown in FIG. 7 may be included in the abnormality detector 465. The log generator 520 illustrated in FIG. 7 may include a sampling log generator 463, a full log generator 464, and an accumulator 467.

  FIG. 13 is a block diagram illustrating a configuration of the server apparatus 300 illustrated in FIG. 9 and the like. The server device 300 includes a sampling log processor 343, a full log processor 344, an abnormality detector 345, an abnormality notifier 346, an accumulator 347 and a communication device 348. These components serve as the acquisition unit 301, the determination unit 302, and the output unit 303 shown in FIG.

  The sampling log processor 343 acquires the sampling log via the communication device 348 and stores the acquired sampling log in the accumulator 347.

  The full log processor 344 acquires a full log via the communication device 348 and stores the acquired full log in the accumulator 347.

  The abnormality detector 345 determines whether or not the communication data includes an abnormality by determining whether or not the sampling log or full log stored in the accumulator 347 includes an abnormality.

  The abnormality notifier 346 transmits an abnormality notification to the terminal device 200 and the security ECU 440 via the communication device 348 when it is determined that the communication data includes an abnormality.

  The accumulator 347 accumulates the sampling log acquired by the sampling log processor 343 and the full log acquired by the full log processor 344. For example, the accumulator 347 is configured with a memory.

  The communication device 348 communicates with the security ECU 440 and the like via, for example, an external network. The communication device 348 communicates with the terminal device 200.

  As an example, the acquisition device 301 and the output device 303 illustrated in FIG. 8 may be included in the communication device 348. The determination unit 302 illustrated in FIG. 8 may be included in the abnormality detector 345.

  FIG. 14 is a sequence diagram showing operations related to the transmission of the sampling log in the security system 100 shown in FIG.

  First, the communication device 448 of the security ECU 440 acquires communication data from the in-vehicle network (S101). Next, the sampling log generator 443 of the security ECU 440 records the sampling log in the accumulator 447 according to the communication data acquired from the in-vehicle network (S102). Further, the full log generator 444 of the security ECU 440 records a full log in the accumulator 447 according to the communication data acquired from the in-vehicle network (S103).

  Further, the abnormality detector 445 of the security ECU 440 performs an abnormality detection process according to the communication data acquired from the in-vehicle network (S104). That is, the abnormality detector 445 of the security ECU 440 determines whether an abnormality is included in the communication data acquired from the in-vehicle network.

  When no abnormality is detected, that is, when it is determined that there is no abnormality in the communication data acquired from the in-vehicle network, the communication device 448 of the security ECU 440 periodically transmits a sampling log (S105). ). For example, the communication device 448 of the security ECU 440 compresses the sampling log recorded in the accumulator 447 and transmits the compressed sampling log to the server device 300.

  The communication device 348 of the server device 300 acquires a sampling log from the security ECU 440. Then, the sampling log processor 343 of the server device 300 records the sampling log acquired from the security ECU 440 in the accumulator 347. For example, the sampling log processor 343 of the server device 300 decompresses the compressed sampling log and records the decompressed sampling log in the storage 347.

  Then, the abnormality detector 345 of the server device 300 performs an abnormality detection process according to the sampling log recorded in the accumulator 347 (S106). That is, the abnormality detector 345 of the server device 300 determines whether or not an abnormality is included in communication data in the in-vehicle network by determining whether or not the sampling log includes an abnormality.

  FIG. 15 is a sequence diagram illustrating operations related to the abnormality detection process performed by the server apparatus 300 illustrated in FIG. 9 and the like.

  When an abnormality is detected in the abnormality detection process (S106) performed by the server device 300, the abnormality notification device 346 of the server device 300 transmits an abnormality notification via the communication device 348. That is, when it is determined that the communication data in the in-vehicle network includes an abnormality according to the sampling log, the abnormality notification device 346 of the server device 300 transmits the abnormality notification via the communication device 348.

  For example, the abnormality notifier 346 of the server device 300 transmits an abnormality notification to the terminal device 200 via the communication device 348 (S107). Then, the terminal device 200 acquires an abnormality notification from the server device 300 and notifies the monitoring organization of the abnormality.

  Further, the abnormality notifier 346 of the server device 300 transmits an abnormality notification to the security ECU 440 via the communication device 348 (S108). Then, the communication device 448 of the security ECU 440 acquires the abnormality notification and notifies the driver of the abnormality (S109).

  For example, the communication device 448 of the security ECU 440 notifies the driver of the abnormality via the notification interface by outputting the abnormality notification to the ECU 450 having a notification interface such as a display or a speaker. Alternatively, when the security ECU 440 has a notification interface, the security ECU 440 may notify the driver of an abnormality via the notification interface of the security ECU 440.

  Moreover, the communication device 448 of the security ECU 440 transmits a full log to the server device 300 when the abnormality notification is acquired (S110). For example, the communication device 448 of the security ECU 440 compresses the full log recorded in the accumulator 447 and transmits the compressed full log to the server device 300.

  Then, the communication device 348 of the server device 300 acquires a full log from the security ECU 440. Then, the full log processor 344 of the server device 300 records the full log acquired from the security ECU 440 in the accumulator 347. For example, the full log processor 344 of the server device 300 decompresses the compressed full log and records the decompressed full log in the storage 347.

  Then, the abnormality detector 345 of the server device 300 performs an abnormality detection process according to the full log recorded in the accumulator 347 (S111). That is, the abnormality detector 345 of the server device 300 determines whether or not an abnormality is included in communication data in the in-vehicle network by determining whether or not an abnormality is included in the full log.

  Then, the communication device 348 of the server device 300 transmits the result of the abnormality detection process to the terminal device 200 (S112). The abnormality notification device 346 of the server device 300 may transmit an abnormality notification to the terminal device 200 as a result of the abnormality detection processing via the communication device 348. The terminal device 200 acquires the result of the abnormality detection process from the server device 300 and notifies the monitoring organization of the result of the abnormality detection process.

  And the terminal device 200 performs the detailed analysis regarding abnormality by being operated by the monitoring organization (S113). In addition, the terminal device 200 performs evidence maintenance by being operated by the monitoring organization (S114). The terminal device 200 may download a full log from the server device 300 for detailed analysis and evidence preservation.

  FIG. 16 is a sequence diagram showing operations related to the abnormality detection process performed by the security ECU 440 shown in FIG. 9 and the like.

  When an abnormality is detected in the abnormality detection process (S104) performed by the security ECU 440, the communication device 448 of the security ECU 440 notifies the driver of the abnormality (S131). That is, when it is determined that the communication data acquired from the in-vehicle network includes an abnormality, the communication device 448 of the security ECU 440 notifies the driver of the abnormality.

  For example, the communication device 448 of the security ECU 440 notifies the driver of the abnormality through the notification interface by outputting the abnormality notification to the ECU 450 having the notification interface. Alternatively, when the security ECU 440 has a notification interface, the security ECU 440 may notify the driver of an abnormality via the notification interface of the security ECU 440.

  Then, the communication device 448 of the security ECU 440 transmits a full log (S132). For example, the communication device 448 of the security ECU 440 compresses the full log recorded in the accumulator 447 and transmits the compressed full log to the server device 300.

  Then, the communication device 348 of the server device 300 acquires a full log from the security ECU 440. Then, the full log processor 344 of the server device 300 records the full log acquired from the security ECU 440 in the accumulator 347. For example, the full log processor 344 of the server device 300 decompresses the compressed full log and records the decompressed full log in the storage 347.

  Then, the abnormality detector 345 of the server device 300 performs an abnormality detection process according to the full log recorded in the accumulator 347 (S133). That is, the abnormality detector 345 of the server device 300 determines whether or not an abnormality is included in communication data in the in-vehicle network by determining whether or not an abnormality is included in the full log.

  When an abnormality is detected, that is, when it is determined that an abnormality is included in the communication data in the in-vehicle network according to the full log, the abnormality notifier 346 of the server device 300 transmits the abnormality notification via the communication device 348. . For example, the abnormality notifier 346 of the server device 300 transmits an abnormality notification to the terminal device 200 via the communication device 348 (S134). Then, the terminal device 200 acquires an abnormality notification from the server device 300 and notifies the monitoring organization of the abnormality.

  Moreover, the abnormality notification device 346 of the server device 300 transmits an abnormality notification to the security ECU 440 via the communication device 348 (S135). Then, the communication device 448 of the security ECU 440 acquires the abnormality notification and notifies the driver of the abnormality (S136). Moreover, the communication device 448 of the security ECU 440 transmits a full log to the server device 300 when the abnormality notification is acquired (S137).

  Then, the communication device 348 of the server device 300 acquires a full log from the security ECU 440. Then, the full log processor 344 of the server device 300 records the full log acquired from the security ECU 440 in the accumulator 347. Then, the abnormality detector 345 of the server device 300 performs an abnormality detection process according to the full log recorded in the accumulator 347 (S138).

  Then, the communication device 348 of the server device 300 transmits the result of the abnormality detection process to the terminal device 200 (S139). The abnormality notification device 346 of the server device 300 may transmit an abnormality notification to the terminal device 200 as a result of the abnormality detection processing via the communication device 348. The terminal device 200 acquires the result of the abnormality detection process from the server device 300 and notifies the monitoring organization of the result of the abnormality detection process.

  And the terminal device 200 performs the detailed analysis regarding abnormality by being operated by the monitoring organization (S140). In addition, the terminal device 200 performs evidence maintenance by being operated by the monitoring organization (S141).

  The processing from the transmission of the abnormality notification (S134) to the evidence device (S141) to the terminal device 200 shown in FIG. 16 is performed from the transmission of the abnormality notification (S107) to the evidence device (S114) to the terminal device 200 shown in FIG. ). In addition, in order to avoid the repetition of the processing, the processing from the transmission of the abnormality notification to the security ECU 440 (S135) to the transmission of the abnormality detection processing result to the terminal device 200 (S139) may be omitted.

  FIG. 17 is a flowchart showing the operation of the security ECU 440 shown in FIG.

  The security ECU 440 performs a log recording process for recording a log of communication data in the in-vehicle network (S201). Further, the security ECU 440 performs an abnormality detection process for detecting an abnormality in the communication data (S202). And security ECU440 performs the log transmission process for transmitting a communication log to the server apparatus 300 (S203). The security ECU 440 repeats these processes (S201 to S203).

  FIG. 18 is a flowchart showing a first mode of the log recording process performed by the security ECU 440 shown in FIG.

  First, the communication device 448 acquires communication data by receiving communication data in the in-vehicle network (S301). Specifically, the communicator 448 acquires a CAN frame as communication data.

  Next, the full log generator 444 records the acquired communication data as a full log in the accumulator 447 (S302). Specifically, the full log generator 444 records the acquired frame in the accumulator 447 as a full log according to the log format of FIG. For example, when a frame acquired in the past is recorded as a full log in the accumulator 447, the full log generator 444 adds information on the newly acquired frame to the payload in the log format of FIG.

  Next, the sampling log generator 443 determines whether or not the current time is within the sampling period by checking the sampling timer in the sampling log generator 443, for example (S303). When the current time is not within the sampling period (No in S304), the security ECU 440 ends the log recording process.

  If the current time is within the sampling period (Yes in S304), the sampling log generator 443 determines whether the acquired communication data is a specific type of communication data. In that case, specifically, the sampling log generator 443 determines whether the ID included in the acquired frame is a specific ID, so that the acquired frame is a specific type of frame. It is determined whether or not.

  When it is determined that the acquired communication data is not a specific type of communication data (No in S305), the security ECU 440 ends the log recording process.

  If it is determined that the acquired communication data is a specific type of communication data (Yes in S305), the sampling log generator 443 records the acquired communication data in the accumulator 447 as a sampling log (S306). .

  Specifically, the sampling log generator 443 records the acquired frame in the accumulator 447 as a sampling log according to the log format of FIG. Further, for example, when a frame acquired in the past is recorded in the accumulator 447 as a sampling log, the sampling log generator 443 adds information on the newly acquired frame to the payload in the log format of FIG. . Then, the security ECU 440 ends the log recording process.

  Note that the sampling log generator 443 and the full log generator 444 basically record the sampling log and the full log separately in the storage 447.

  FIG. 19 is a flowchart showing a second mode of the log recording process performed by the security ECU 440 shown in FIG. 9 and the like. In the second aspect of the log recording process shown in FIG. 19, the processes (S301 to S306) from the acquisition of communication data to the recording of the communication data as a sampling log are the same as the log recording process shown in FIG. The same as in the first aspect.

  In the second aspect of the log recording process shown in FIG. 19, the sampling log generator 443 updates the time length of the sampling interval after recording the communication data as a sampling log (S307).

  For example, the sampling log generator 443 randomly updates the time length of the sampling interval in a range between the minimum value and the maximum value. Here, each of the minimum value and the maximum value is predetermined to be larger than the time length of the sampling period. Alternatively, the sampling log generator 443 may update the time length of the sampling interval linearly in a range between the minimum value and the maximum value.

  Specifically, the sampling log generator 443 may gradually increase the time length of the sampling interval from the minimum value to the maximum value. That is, the sampling log generator 443 may increase the time length of the sampling interval stepwise from the minimum value to the maximum value. Then, after the time length of the sampling interval reaches the maximum value, the time length of the sampling interval may be gradually decreased from the maximum value to the minimum value. That is, the sampling log generator 443 may reduce the time length of the sampling interval in steps from the minimum value to the maximum value.

  Thereby, the security ECU 440 can variously change the time length of the sampling interval related to the sampling log. Accordingly, the security ECU 440 can include an abnormality that is not included in the fixed sampling interval in the sampling log. Further, the security ECU 440 can make it difficult to analyze the sampling interval. Therefore, the security ECU 440 can suppress a phenomenon in which an abnormality based on unauthorized data is not included in the sampling log.

  Note that the sampling log generator 443 may update a specific type related to the sampling log in addition to updating the sampling interval or instead of updating the sampling interval.

  In the log recording process described above, for example, an instruction regarding a sampling interval or a specific type is output from the output device 442 included in the communication device 448 to the log generator 520 including the sampling log generator 443. Then, the sampling interval or the specific type is updated according to the instruction regarding the sampling interval or the specific type.

  FIG. 20 is a flowchart showing an abnormality detection process performed by the security ECU 440 shown in FIG.

  In the abnormality detection process, the abnormality detector 445 performs matching processing between the communication data acquired by the communication device 448 and the abnormality pattern (S401). That is, the abnormality detector 445 determines whether or not the communication data acquired by the communication device 448 matches a predetermined abnormality pattern. Here, the communication data acquired by the communication device 448 is more specifically one or more data frames acquired as communication data by the communication device 448.

  If the abnormality detector 445 determines that the communication data acquired by the communication device 448 matches a predetermined abnormality pattern (Yes in S402), the abnormality detector 445 detects an abnormality (S403). In other words, the abnormality detector 445 determines that an abnormality is included in the communication data in this case. In other words, the abnormality detector 445 detects that the communication data acquired by the communication device 448 matches a predetermined abnormality pattern as an abnormality in the communication data.

  Further, the communication device 448 performs an abnormality notification reception process for receiving an abnormality notification from the server device 300 (S404). Specifically, when an abnormality notification is transmitted from the server device 300, the communication device 448 receives the abnormality notification transmitted from the server device 300.

  Then, when the communication device 448 receives an abnormality notification from the server device 300 (Yes in S405), the abnormality detector 445 detects an abnormality (S406). In other words, the abnormality detector 445 determines that an abnormality is included in the communication data in this case. In other words, the abnormality detector 445 detects that the communication device 448 has received the abnormality notification from the server device 300 as an abnormality in the communication data.

  In addition, when it is determined that the communication data acquired by the communication device 448 does not match a predetermined abnormality pattern, and the communication device 448 does not receive the abnormality notification from the server device 300, the abnormality detector 445 detects the abnormality. do not do. That is, in this case, the abnormality detector 445 determines that no abnormality is included in the communication data.

  In the above abnormality detection process, the matching process between the communication data and the abnormal pattern is performed, but the matching process between the communication data and the normal pattern may be performed. In this case, when it is determined that the communication data does not match a predetermined normal pattern, the abnormality detector 445 detects an abnormality.

  In CAN, the same kind of data frames are assumed to flow at a constant cycle. Therefore, the abnormality detector 445 may detect an abnormality when the same type of data frame does not flow at a constant cycle. Specifically, the abnormality detector 445 may determine whether or not the data frame is flowing at a constant cycle using the time interval at which the data frame is acquired, and may detect an abnormality according to the determination result. . Moreover, the period of the same kind of data frame which flows through CAN may be contained in the abnormal pattern or the normal pattern.

  In addition, it is assumed that a plurality of data frames of the same kind that flow at a constant cycle have continuity in data contents. For example, the abnormality detector 445 may detect a data frame having a data value having a large deviation from the data value of the previous data frame as an abnormality in a plurality of data frames of the same type. Moreover, the magnitude | size of deviation may be contained in the abnormal pattern or the normal pattern. The magnitude of the divergence can also be expressed as a difference in data values.

  Further, the timing of the abnormality notification reception process (S404) is not limited to the example of FIG. The communication device 448 receives the abnormality notification transmitted from the server device 300 at the timing when the abnormality notification is transmitted from the server device 300.

  Further, the security ECU 440 may perform only one of the unique abnormality detection (S401 to S403) in the security ECU 440 and the abnormality detection (S404 to S406) based on the server device 300.

  The configuration in which the security ECU 440 performs unique abnormality detection (S401 to S403) corresponds to a configuration in which the abnormality detector 510 illustrated in FIG. 7 is included in the security ECU 440. The configuration in which the security ECU 440 performs abnormality detection (S404 to S406) based on the server device 300 corresponds to a configuration in which the abnormality detector 510 illustrated in FIG.

  The configuration in which both the unique abnormality detection (S401 to S403) and the abnormality detection (S404 to S406) based on the server device 300 are performed includes the abnormality detector 510 in each of the security ECU 440 and the server device 300. Corresponds to the configuration.

  FIG. 21 is a flowchart showing a first mode of log transmission processing performed by security ECU 440 shown in FIG. 9 and the like.

  In this aspect, the abnormality detector 445 determines whether or not an abnormality in communication data has been detected (S501). When it is determined that an abnormality in the communication data is detected, that is, when it is determined that the communication data includes an abnormality, the communication device 448 notifies the driver of the abnormality (S502). For example, the communication device 448 notifies the driver of the abnormality via the notification interface by outputting the abnormality notification to the ECU 450 having the notification interface.

  Then, the communication device 448 compresses the full log recorded in the storage device 447 (S503). For example, the communication device 448 reversibly compresses the full log using a compression method such as 7-Zip. Then, the communication device 448 transmits the compressed full log to the server device 300 (S504). The communication device 448 may delete the full log recorded in the storage device 447 from the storage device 447 after the transmission of the full log.

  On the other hand, when it is determined that no abnormality is detected in the communication data, that is, when it is determined that no abnormality is included in the communication data, the communicator 448 checks the periodic transmission timer so that the current time is It is determined whether it is a transmission timing (S511). When it is determined that the current time is not the timing of regular transmission (No in S512), the security ECU 440 ends the log transmission process.

  When it is determined that the current time is the timing of regular transmission (Yes in S512), the communication device 448 compresses the sampling log recorded in the storage device 447 (S513). For example, the communication device 448 reversibly compresses the sampling log using a compression method such as 7-Zip. Then, the communication device 448 transmits the compressed sampling log to the server device 300 (S514). The communication device 448 may delete the sampling log recorded in the accumulator 447 from the accumulator 447 after transmitting the sampling log.

  By the log transmission process, a sampling log with a relatively small amount of data is periodically transmitted from the security ECU 440 to the server device 300, and a full log with a relatively large amount of data is transmitted when there is an abnormality.

  Note that the periodic transmission timing is, for example, once per minute. Then, the communicator 448 may determine that the current time is the timing of regular transmission when one minute or more has elapsed since the previous sampling log was transmitted. Thereby, the communication device 448 periodically transmits the sampling log. Basically, the cycle at which the sampling log is transmitted is longer than the sampling interval for recording the sampling log.

  Further, for example, the full log transmitted to the server device 300 is a full log in a predetermined period in the past. The predetermined period is, for example, 1 hour. The accumulator 447 may record a full log for a predetermined period. Therefore, a ring buffer for recording full logs for a predetermined period may be used for recording full logs. Similarly, a ring buffer for recording a sampling log for the transmission period may be used for recording the sampling log.

  In the above log transmission process, when an abnormality is detected, a full log is transmitted and a sampling log is not transmitted. However, the sampling log may be periodically transmitted regardless of whether an abnormality is detected.

  In the log transmission process, for example, the acquisition unit 441 included in the communication device 448 acquires the abnormality detection result from the abnormality detector 445. Then, in the communication device 448, an instruction to transmit the sampling log or full log is output from the output device 442 to the transmitter 530 according to the abnormality detection result. Then, the sampling log or the full log is transmitted according to the transmission instruction.

  FIG. 22 is a flowchart showing a second mode of log transmission processing performed by security ECU 440 shown in FIG. 9 and the like. In the second mode of the log transmission process shown in FIG. 22, the processes (S501 to S504 and S511 to S514) until the full log and the sampling log are transmitted are the same as the first mode of the log transmission process shown in FIG. The same.

  In this aspect, after the full log is transmitted, the sampling log generator 443 updates the sampling interval to be shorter (S505). That is, when an abnormality is detected, the sampling log generator 443 reduces the time length of the sampling interval. In addition, after the sampling log is transmitted, the sampling log generator 443 updates the sampling interval longer (S515). That is, when no abnormality is detected, the sampling log generator 443 increases the time length of the sampling interval.

  In the above update, the sampling log generator 443 updates the time length of the sampling interval in a range between the minimum value and the maximum value. The sampling log generator 443 may reduce or increase the time length of the sampling interval by a predetermined fixed length by one update. The sampling log generator 443 may decrease or increase the time length of the sampling interval by a random length by one update.

  By updating as described above, the security ECU 440 can increase the data amount of the sampling log after the abnormality. Then, the security ECU 440 can include an abnormality that is not included in the long sampling interval in the sampling log. Further, the security ECU 440 can reduce the data amount of the sampling log when there is no abnormality.

  In this aspect, the sampling interval is updated for all types regardless of the type of communication data in which an abnormality is detected. That is, the sampling interval is updated for all the IDs regardless of the ID of the frame in which the abnormality is detected.

  In the above update, for example, an instruction regarding the sampling interval is output from the output device 442 included in the communication device 448 to the sampling log generator 443 constituting the log generator 520. Then, the sampling interval is updated according to the instruction regarding the sampling interval.

  FIG. 23 is a flowchart showing a third mode of log transmission processing performed by security ECU 440 shown in FIG. 9 and the like. In the third mode of the log transmission process shown in FIG. 23, the processes (S501 to S504 and S511 to S514) until the full log and the sampling log are transmitted are the same as those of the log transmission process shown in FIGS. The same as the first aspect and the second aspect.

  In this aspect, after the full log is transmitted, the sampling log generator 443 updates the sampling interval short for the type of communication data in which an abnormality is detected (S506). Then, the sampling log generator 443 maintains sampling intervals for other types. That is, when an abnormality is detected in one type of communication data, the sampling log generator 443 reduces the time length of the sampling interval for that one type.

  In addition, after the sampling log is transmitted, the sampling log generator 443 updates the sampling interval that has been updated short for a long time (S516). That is, when no abnormality is detected, the sampling log generator 443 returns the time length of the sampling interval to the original time length. Alternatively, in this case, the sampling log generator 443 brings the time length of the sampling interval closer to the original time length.

  Similar to the second mode of the log transmission process shown in FIG. 22, the sampling log generator 443 updates the time length of the sampling interval in a range between the minimum value and the maximum value. The sampling log generator 443 may reduce or increase the time length of the sampling interval by a predetermined fixed length by one update. The sampling log generator 443 may decrease or increase the time length of the sampling interval by a random length by one update.

  By updating as described above, the security ECU 440 can increase the data amount of the sampling log for each type after the abnormality. Further, the security ECU 440 can reduce the increased amount of data when there is no abnormality.

  FIG. 24 is a flowchart showing a first mode of operation of the server apparatus 300 shown in FIG.

  First, the communication device 348 receives a sampling log or a full log from the security ECU 440 (S601). When the sampling log is received (Yes in S602), the sampling log processor 343 records the sampling log in the accumulator 347. For example, the sampling log processor 343 decompresses the compressed sampling log, and records the decompressed sampling log in the storage 347.

  Then, the abnormality detector 345 performs an abnormality detection process according to the sampling log (S603). For example, the abnormality detector 345 performs matching processing between the communication data and the abnormality pattern in the same manner as the matching processing (S401) performed by the abnormality detector 445 of the security ECU 440. However, the abnormality detector 345 uses the communication data indicated by the sampling log for the matching process.

  That is, the abnormality detector 345 determines whether or not the communication data indicated by the sampling log matches a predetermined abnormality pattern. More specifically, the abnormality detector 345 determines whether or not the data frame indicated by the sampling log matches a predetermined abnormality pattern.

  If the abnormality detector 345 determines that the communication data indicated by the sampling log matches a predetermined abnormality pattern, the abnormality detector 345 detects an abnormality. In other words, the abnormality detector 345 determines in this case that the communication data includes an abnormality. In other words, the abnormality detector 345 detects that the communication data indicated by the sampling log matches a predetermined abnormality pattern as an abnormality in the communication data.

  In the log reception (S601), when the sampling log is not received (No in S602), that is, when the full log is received, the full log processor 344 records the full log in the accumulator 347. For example, the full log processor 344 decompresses the compressed full log, and records the decompressed full log in the storage 347.

  Then, the abnormality detector 345 performs an abnormality detection process according to the full log (S604). For example, the abnormality detector 345 performs matching processing between the communication data and the abnormality pattern in the same manner as the matching processing (S401) performed by the abnormality detector 445 of the security ECU 440. However, the abnormality detector 345 uses the communication data indicated by the full log for the matching process.

  That is, the abnormality detector 345 determines whether or not the communication data indicated by the full log matches a predetermined abnormality pattern. More specifically, the abnormality detector 345 determines whether or not the frame indicated by the full log matches a predetermined abnormality pattern.

  If the abnormality detector 345 determines that the communication data indicated by the full log matches a predetermined abnormality pattern, the abnormality detector 345 detects the abnormality. In other words, the abnormality detector 345 determines in this case that the communication data includes an abnormality. In other words, the abnormality detector 345 detects that the communication data indicated by the full log matches a predetermined abnormality pattern as an abnormality in the communication data.

  Next, the abnormality detector 345 determines whether or not communication data abnormality is detected (S605). When it is determined that an abnormality of the communication data is detected, that is, when it is determined that the communication data includes an abnormality (Yes in S605), the communication device 348 transmits an abnormality notification to the terminal device 200 ( S606). In the log reception (S601), when the full log is received (Yes in S607), the server apparatus 300 ends the series of processes.

  In the log reception (S601), when the full log is not received (No in S607), that is, when the sampling log is received, the communication device 348 transmits an abnormality notification to the security ECU 440 (S608). The communication device 348 causes the security ECU 440 to transmit a full log to the server device 300 by transmitting an abnormality notification to the security ECU 440. And the server apparatus 300 complete | finishes a series of processes.

  The sampling log abnormality detection process (S603) and the full log abnormality detection process (S604) are described separately in FIG. 24, but they may be common processes. That is, the abnormality detector 345 may perform a common abnormality detection process regardless of the sampling log or the full log.

  Further, in the above abnormality detection processing (S603 and S604), the matching processing between the communication data and the abnormal pattern is performed, but the matching processing between the communication data and the normal pattern may be performed. In this case, when it is determined that the communication data does not match a predetermined normal pattern, the abnormality detector 345 detects an abnormality.

  In addition, a more complex matching process than the matching process (S401) performed in the security ECU 440 may be performed in the abnormality detection process (S603 and S604). The server apparatus 300 can perform the matching process by using sufficient processing capability that is not restricted by the requirements for in-vehicle use. For example, more abnormality patterns may be used in the abnormality detection process (S603 and S604) than the matching process (S401) performed in the security ECU 440.

  In CAN, the same kind of data frames are assumed to flow at a constant cycle. Therefore, the abnormality detector 345 may detect an abnormality when the same type of data frame does not flow at a constant cycle. Specifically, the abnormality detector 345 may determine whether or not the data frame is flowing at a constant cycle using the time interval at which the data frame is acquired, and may detect an abnormality according to the determination result. . Moreover, the period of the same kind of data frame which flows through CAN may be contained in the abnormal pattern or the normal pattern.

  However, the determination of whether or not the data frame is flowing at a constant cycle is effective when the previous data frame is not missing, and is not valid when the previous data frame is missing.

  Therefore, when the data frame included in the sampling log is the first data frame in the sampling period, the abnormality detector 345 does not use the determination as to whether or not the data frame is flowing at a constant cycle for detecting the abnormality. On the other hand, when the data frame included in the sampling log is not the first data frame in the sampling period, the abnormality detector 345 uses the determination as to whether or not the data frame is flowing at a constant cycle for detecting the abnormality.

  Specifically, when the data frame included in the sampling log is not the first data frame in the sampling period, the abnormality detector 345 determines the difference between the sampling time of the data frame and the previous data frame. Used for detection. If the difference in sampling time corresponds to a certain periodic interval, the abnormality detector 345 determines that the data frame is normal. On the other hand, if the difference in sampling time does not correspond to a certain periodic interval, the abnormality detector 345 determines that the data frame is abnormal.

  Further, since the type is also related to the period, the difference in sampling time regarding the same type of data frame may be used for detecting an abnormality. That is, in the same sampling period and the same type, the difference between the sampling time of the data frame and the sampling time of the previous data frame may be used for detecting an abnormality.

  Whether the data frame included in the sampling log corresponds to the first data frame can be identified by the log format flag shown in FIG. Further, since a data frame is not lost in the full log, a difference in sampling time may be used for detecting an abnormality with respect to the full log.

  In addition, it is assumed that data frames of the same kind that flow at a constant cycle have continuity in data contents. Therefore, the difference in the data value between the data frame and the previous data frame may be used for detecting an abnormality, like the difference in sampling time. Also in this case, similarly to the difference in sampling time, a difference in data value may be used for detecting an abnormality for a data frame different from the first data frame.

  FIG. 25 is a flowchart showing a second mode of operation of the server apparatus 300 shown in FIG. In the second mode shown in FIG. 25, the processing (S601 to S608) from the reception of the log to the transmission of the abnormality notification is the same as the first mode shown in FIG.

  In this aspect, the server apparatus 300 then performs a sampling interval update process (S609). For example, the communication device 348 transmits to the security ECU 440 a change instruction that causes the security ECU 440 to change the time length of the sampling interval. Then, the security ECU 440 changes the time length of the sampling interval. 26 and 27 show a more specific aspect regarding the sampling interval update processing.

  FIG. 26 is a flowchart showing a first aspect of the sampling interval update process performed by server device 300 and security ECU 440 shown in FIG. 9 and the like.

  In this aspect, first, in the server apparatus 300, the communication device 348 specifies the vehicle type of the vehicle 400 that is the transmission source of the log received in the log reception (S601) (S701). The communication device 348 may specify the vehicle type of the vehicle 400 according to the vehicle ID included in the log. Alternatively, the communication device 348 may specify the vehicle type of the vehicle 400 by newly communicating with the security ECU 440 or the like.

  Next, the communication device 348 acquires the current sampling interval for the specified vehicle type (S702). The current sampling interval may be recorded in the accumulator 347 for each vehicle type. Then, the communicator 348 may acquire the current sampling interval from the accumulator 347. Alternatively, the communication device 348 may acquire the current sampling interval by newly communicating with the security ECU 440 or the like.

  When an abnormality is detected in the abnormality detection process (S603 or S604) (Yes in S703), the communication device 348 updates the sampling interval to be shorter (S704). That is, the communicator 348 defines a sampling interval that is shorter than the current sampling interval.

  On the other hand, when no abnormality is detected in the abnormality detection process (S603 or S604) (No in S703), the communication device 348 updates the sampling interval longer (S705). That is, the communicator 348 defines a sampling interval that is longer than the current sampling interval.

  Then, the communication device 348 transmits the updated sampling interval, that is, the newly determined sampling interval, to the plurality of security ECUs of the plurality of vehicles having the same vehicle type as the specified vehicle type (S706).

  In security ECU 440 included in the plurality of security ECUs to which the sampling intervals are transmitted, communication device 448 receives the sampling intervals transmitted from server device 300 (S801). Then, the sampling log generator 443 updates the current sampling interval to the received sampling interval (S802). That is, the communication device 448 receives an instruction to change the sampling interval from the server device 300 as an external instruction, and the sampling log generator 443 updates the sampling interval according to the external instruction.

  Thereby, the server apparatus 300 can increase the data amount of the sampling log after the abnormality. Then, the server apparatus 300 can include an abnormality that is not included in the long sampling interval in the sampling log. Moreover, the server apparatus 300 can reduce the data amount of a sampling log, when there is no abnormality. Moreover, the server apparatus 300 can change the time length of the sampling interval relevant to a sampling log about the some vehicle-mounted system of the same vehicle type.

  Note that the communication device 348 may update the sampling interval for each type. For example, when an abnormality is detected for one type, the communication device 348 may shorten the sampling interval for the one type. And when abnormality is not detected, the communication apparatus 348 may lengthen the shortened sampling interval. And you may perform such an update with respect to the same vehicle type. Thereby, the data amount is adjusted appropriately for each vehicle type and each type.

  Alternatively, when an abnormality is detected for one type, the communication device 348 may shorten the sampling interval for all types regardless of the type. If no abnormality is detected, the communication device 348 may increase the sampling interval for all types regardless of the type. As a result, the data amount is appropriately adjusted for each vehicle type regardless of the type.

  FIG. 27 is a flowchart showing a second mode of the sampling interval update process performed by server device 300 and security ECU 440 shown in FIG. 9 and the like.

  In this aspect, first, in the server device 300, the communication device 348 specifies the area of the vehicle 400 that is the transmission source of the log received in the log reception (S601) (S711). The communication device 348 may specify the area of the vehicle 400 according to the vehicle ID included in the log. Alternatively, the communication device 348 may specify the area of the vehicle 400 by newly communicating with the security ECU 440 or the like.

  Basically, a large area such as a country is assumed as a region. Such an area can be predetermined for the vehicle 400. However, a more specific region of the currently traveling vehicle 400 may be used. Such a region can be specified by GPS (Global Positioning System) or the like.

  Next, the communication device 348 acquires the current sampling interval for the specified area (S712). The current sampling interval may be recorded in the accumulator 347 for each region. Then, the communicator 348 may acquire the current sampling interval from the accumulator 347. Alternatively, the communication device 348 may acquire the current sampling interval by newly communicating with the security ECU 440 or the like.

  When an abnormality is detected in the abnormality detection process (S603 or S604) (Yes in S713), the communication device 348 updates the sampling interval to be shorter (S714). That is, the communicator 348 defines a sampling interval that is shorter than the current sampling interval.

  On the other hand, when no abnormality is detected in the abnormality detection process (S603 or S604) (No in S713), the communication device 348 updates the sampling interval longer (S715). That is, the communicator 348 defines a sampling interval that is longer than the current sampling interval.

  Then, the communication device 348 transmits the updated sampling interval, that is, the newly determined sampling interval, to the plurality of security ECUs of the plurality of vehicles having the same area as the specified area (S716).

  Similar to the first aspect of the sampling interval update process, in security ECU 440 included in the plurality of security ECUs to which the sampling intervals have been transmitted, communication device 448 receives the sampling interval transmitted from server device 300 (S801). Then, the sampling log generator 443 updates the current sampling interval to the received sampling interval (S802). That is, security ECU 440 receives an instruction to change the sampling interval as an external instruction, and updates the sampling interval in accordance with the external instruction.

  Thereby, the server apparatus 300 can change the time length of the sampling interval relevant to a sampling log about the some vehicle-mounted system of the same area.

  Similarly to the first aspect of the sampling interval update process, the communication device 348 may update the sampling interval for each type. Thereby, the data amount is adjusted appropriately for each region and each type. Alternatively, the communication device 348 may update the sampling interval regardless of the type. Thereby, the data amount is appropriately adjusted for each region regardless of the type.

[Supplement]
In the above embodiment, the CAN protocol is used as the in-vehicle network, but the present invention is not limited to this. For example, CAN-FD (CAN with Flexible Data Rate), FlexRay, Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), or the like may be used. Alternatively, a network combining these networks as sub-networks with CAN may be used.

  In the above embodiment, each component may be configured by dedicated hardware or may be realized by executing a software program suitable for each component. Each component may be realized by a program executor such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software that realizes the information processing apparatus of the above-described embodiment is a program as follows.

  That is, this program is an information processing method performed by an information processing device mounted on a vehicle in a computer that is an information processing device, and detects whether or not the communication data in the in-vehicle network of the vehicle includes an abnormality. An acquisition step of acquiring a result from an abnormality detector, and a transmitter in which a sampling log in which the amount of data generated per unit time is smaller than the other log among the two types of logs of the communication data is mounted on the vehicle An output step of outputting a sampling log transmission instruction for periodically transmitting to a server device provided outside the vehicle, wherein the output step further indicates that the communication data includes an abnormality When the detection result is acquired in the acquisition step, data generated per unit time of the two types of logs There executing an information processing method for outputting a full log transmission instruction to transmit a full log is larger logs than the sampling log from the transmitter to the server device.

  The program may be recorded on a non-temporary recording medium such as a CD-ROM. Further, the information processing apparatus may be implemented by an integrated circuit.

  In the above embodiment, each component may be a circuit. A plurality of components may constitute one circuit as a whole, or may constitute separate circuits. Each circuit may be a general-purpose circuit or a dedicated circuit.

  In the above embodiment, the transmission method for transmitting information from the transmission source to the transmission destination may be a transmission method in which information on the transmission source and the transmission destination is not included in the transmitted information. Any transmission method that transmits information from the transmission source to the transmission destination may be used. Specifically, a transmission method such as broadcast may be used. The same applies to the output method for outputting information from the output source to the output destination. Moreover, the acquisition method for acquiring information from the acquisition source may be any acquisition method that acquires information from the acquisition source as a result.

  As described above, the information processing apparatus according to one or more aspects has been described based on the embodiment, but the present disclosure is not limited to this embodiment. Unless it deviates from the gist of the present disclosure, various modifications conceived by those skilled in the art have been made in this embodiment, and forms constructed by combining components in different embodiments are also within the scope of one or more aspects. May be included.

  For example, in the above-described embodiment, a process executed by a specific component may be executed by another component instead of the specific component. Further, the order of the plurality of processes may be changed, and the plurality of processes may be executed in parallel.

  The present disclosure can be used for a security system for monitoring data related to a vehicle.

DESCRIPTION OF SYMBOLS 100 Security system 200 Terminal device 300 Server apparatus 301,441 Acquisition device 302 Judgment device 303,442 Output device 343 Sampling log processing device 344 Full log processing device 345,445,465,510 Abnormality detector 346 Abnormality notification device 347,447,467 Accumulator 348, 448 Communication device 400 Vehicle 410 In-vehicle system 421 Head-up display 422 Telematics communication unit 423 V2X module 424 OBD module 430 Gateway device 440 Security ECU
443, 463 Sampling log generator 444, 464 Full log generator 446, 466 Abnormal data invalidator 450, 451, 452 ECU
460 Security gateway device 469 Transfer processor 470 External communication device 471 In-vehicle communication device 520 Log generator 530 Transmitter

Claims (21)

An information processing apparatus mounted on a vehicle,
An acquisition unit for acquiring an abnormality detection result from the abnormality detector as to whether or not an abnormality is included in the communication data in the in-vehicle network of the vehicle;
A sampling log in which the amount of data generated per unit time among the two types of logs of the communication data is smaller than that of the other log is transmitted from the transmitter mounted on the vehicle to a server device provided outside the vehicle. An output device that outputs a sampling log transmission instruction to be transmitted periodically;
In the output device, when the acquisition unit acquires the abnormality detection result indicating that the communication data includes an abnormality, the amount of data generated per unit time of the two types of logs is greater than the sampling log. An information processing apparatus that outputs a full log transmission instruction for transmitting a full log, which is a larger log, from the transmitter to the server apparatus. The information processing apparatus further includes the abnormality detector,
The information processing apparatus according to claim 1, wherein the abnormality detector acquires the communication data from the in-vehicle network and determines whether or not the communication data includes an abnormality. The sampling log is a plurality of periods each included in the plurality of sampling intervals among a plurality of sampling intervals each of which is a period of a first time length, each of which is a second time length shorter than the first time length the information processing apparatus according to claim 1 or 2 in a plurality of sampling period in a log of the communication data. The sampling log includes, for each of a plurality of frames constituting the communication data in the plurality of sampling periods, (i) the sampling time of the frame, and (ii) the frame in one or more frames having the same sampling period as the frame. The information processing apparatus according to claim 3 , which indicates whether or not is a first frame and (iii) data of the frame. The full log is a log of the communication data of a plurality of types,
The sampling log is a log of the communication data of one or more types less than the plurality of types, and for each of a plurality of frames constituting the communication data of the one or more types in the plurality of sampling periods, (I) Sampling time of the frame, (ii) Whether the frame is the first frame in one or more frames having the same type and sampling period as the frame, and (iii) Data of the frame. Item 4. The information processing device according to Item 3 . The full log is a log of the communication data of a plurality of types,
The sampling logs information processing apparatus according to any one of claims 1 to 3, which is the log of the communication data of the plurality of one or more types less than classification. The information processing apparatus further includes the transmitter,
The transmitter transmits the sampling log to the server device according to the sampling log transmission instruction output from the output device, and transmits the full log to the server device according to the full log transmission instruction output from the output device. The information processing apparatus according to any one of claims 1 to 6 . The transmitter is
In accordance with the sampling log transmission instruction output from the output device, the sampling log is reversibly compressed, and the compressed sampling log is transmitted to the server device.
The information processing apparatus according to claim 7 , wherein the full log is reversibly compressed in accordance with the full log transmission instruction output from the output device, and the compressed full log is transmitted to the server apparatus. The full log and the sampling log are generated by a log generator mounted on the vehicle,
The output device is
Outputting the sampling log transmission instruction to periodically transmit the sampling log generated by the log generator from the transmitter to the server device;
When the acquisition unit acquires the abnormality detection result indicating that the communication data includes an abnormality, the full log transmission instruction to transmit the full log generated by the log generator from the transmitter to the server device. The information processing apparatus according to any one of claims 1 to 8 . The sampling log is a plurality of periods each included in the plurality of sampling intervals among a plurality of sampling intervals each of which is a period of a first time length, each of which is a second time length shorter than the first time length A log of the communication data in a plurality of sampling periods,
The information processing apparatus according to claim 9 , wherein the output device further outputs a change instruction for causing the log generator to change the first time length in a range longer than the second time length. When the acquisition unit acquires the abnormality detection result indicating that the communication data includes an abnormality, the output unit adds the first time length to the log generator in a range longer than the second time length. The information processing apparatus according to claim 10 , wherein the change instruction to be shortened is output. The output unit outputs the change instruction to increase the first time length to the log generator when the acquisition unit does not acquire the abnormality detection result indicating that the communication data includes an abnormality. The information processing apparatus according to claim 10 or 11 . The first time length is determined for each of a plurality of types related to the communication data,
When the acquisition unit acquires the abnormality detection result indicating that the communication data includes an abnormality for one of the plurality of types, the output unit transmits the second time length to the log generator. The information processing apparatus according to claim 10 , wherein the change instruction that shortens the first time length for the one type in a longer range is output. The first time length is determined for each of a plurality of types related to the communication data,
When the acquisition unit acquires the abnormality detection result indicating that the communication data includes an abnormality for one of the plurality of types, the output unit transmits the second time length to the log generator. The information processing apparatus according to claim 10 , wherein the change instruction for shortening the first time length is output for each of the plurality of types in a longer range. The output device, when the acquisition unit does not acquire the abnormality detection result indicating that the communication data includes an abnormality, the change instruction to increase the shortened first time length to the log generator The information processing apparatus according to claim 13 or 14 . The information processing apparatus according to claim 10 , wherein the output device outputs the change instruction that causes the log generator to randomly change the first time length in a range longer than the second time length. The information processing apparatus according to claim 10 , wherein the output device outputs the change instruction that causes the log generator to linearly change the first time length in a range longer than the second time length. The acquisition unit further acquires an instruction to change the first time length from the server device as an external instruction,
The output device outputs the change instruction for causing the log generator to change the first time length in a range longer than the second time length in accordance with the external instruction acquired by the acquiring device from the server device. Item 11. The information processing apparatus according to Item 10 . The full log is a log of the communication data of a plurality of types,
The sampling log is a log of the communication data of one or more types of the plurality of types,
The information processing apparatus according to any one of claims 9 to 18 , wherein the output device outputs specific information that causes the log generator to specify the one or more types. The information processing apparatus further includes the log generator,
The information processing apparatus according to any one of Claims 9 to 19 , wherein the log generator acquires the communication data from the in-vehicle network and generates the full log and the sampling log according to the communication data. An information processing method performed by an information processing device mounted on a vehicle,
An acquisition step of acquiring an abnormality detection result from the abnormality detector as to whether or not an abnormality is included in the communication data in the in-vehicle network of the vehicle;
A sampling log in which the amount of data generated per unit time among the two types of logs of the communication data is smaller than that of the other log is transmitted from the transmitter mounted on the vehicle to a server device provided outside the vehicle. An output step of outputting a sampling log transmission instruction to be transmitted periodically,
In the output step, when the abnormality detection result indicating that the communication data includes an abnormality is acquired in the acquisition step, a data amount generated per unit time of the two types of logs is greater than the sampling log. An information processing method for outputting a full log transmission instruction for transmitting a full log, which is a larger log, from the transmitter to the server device.

Images